Method and system for assignment of membership through script

Abstract

A method of determining membership in a group includes receiving a request to determine if an element is a member of a group. The request may be generated by a software application where the application provides at least one parameter to a script which resides external to the application. The script, along with an optional application-provided parameter, is evaluated to determine the membership of the element in the group. Generally, the script is flexibly generated by an administrator independent of the development of the application. After evaluation, a response is sent back to the application where the response is an indication of membership of the element in the group. The method may optionally allows the script to access an external data source to provide additional information to determine membership. In some applications of the invention, determinations of membership may be used for access determination purposes.

1 . A method of determining membership in a group, the method comprising: 
 receiving, from a software application, a runtime request to determine if an element is a member of a group, the request being received by an evaluation engine having policy rules defining the group;    evaluating membership of the element in the group after the runtime request is received by applying the policy rules maintained external to the application, the policy rules being available to an administrator for modification independently of the application; and    sending a response to the application, wherein the response is an indication of membership of the element in the group.    
   
   
       2 . The method of  claim 1 , further comprising: 
 accessing a database external to the application to acquire additional information for evaluation of the request.    
   
   
       3 . The method of  claim 1 , wherein evaluating membership of the element in the group after the runtime request is received by applying the policy rules comprises evaluating the runtime request using script maintained by an administrator that defines membership rules for an element in a group.  
   
   
       4 . The method of  claim 3 , wherein the script comprises a scripting language having at least one declarative IF/THEN statement.  
   
   
       5 . The method of  claim 1 , wherein receiving a runtime request to determine if an element is a member of a group comprises receiving a runtime request having at least one parameter from the application, and wherein evaluating membership of the element in the group comprises evaluating the policy rules along with the at least one parameter.  
   
   
       6 . The method of  claim 5 , wherein receiving a runtime request having at least one parameter from the application comprises receiving from the application a request to determine if a user has access permission and passing to an evaluation engine parameters of the user.  
   
   
       7 . The method of  claim 1 , wherein sending a response to the application, wherein the response is an indication of membership of the element in the group comprises sending one of an access grant and an access denial concerning a user to an application that requested an access determination.  
   
   
       8 . The method of  claim 1 , wherein receiving, from a software application, a runtime request to determine if an element is a member of a group comprises receiving the runtime request by an evaluation engine via an application programming interface called by the application.  
   
   
       9 . A system for determining membership of an element in a group, the system comprising; 
 a software application;    a storage area for a script, the script being separate from the application;    an interface for editing the script;    an evaluation engine for executing the script; and    at least one processor having access to memory, the memory having instructions which when executed, perform a method comprising: 
 receiving, from the software application, a request to determine if an element is a member of a group, the request being received by the evaluation engine having policy rules defining the group;  
 evaluating membership of the element in the group after the request is received by executing the script; and  
 responding to the request by providing the application an indication of membership of the element in the group.  
   
   
   
       10 . The system of  claim 9 , further comprising an application programming interface accessed by the application to invoke the function of the evaluation engine.  
   
   
       11 . The system of  claim 9 , further comprising an external data source accessed by the evaluation engine to retrieve at least one external parameter useful for determination of membership of an element in a group.  
   
   
       12 . The system of  claim 9 , wherein the script comprises a scripting language having at least one IF/THEN statement.  
   
   
       13 . The system of  claim 9 , wherein the method step of receiving a request to determine if an element is a member of a group comprises receiving a runtime request having at least one parameter from the application, and wherein evaluating membership of the element in the group comprises evaluating the policy rules along with the at least one parameter.  
   
   
       14 . The system of  claim 13  , wherein the method step of receiving a request having at least one parameter from the application comprises receiving from the application a request to determine if a user has access permission and passing to an evaluation engine parameters of the user.  
   
   
       15 . The computer system of  claim 9 , wherein the method step of sending a response to the application, wherein the response is an indication of membership of the element in the group comprises sending one of an access grant and an access denial concerning a user to an application that requested an access determination.  
   
   
       16 . A computer-readable medium, comprising instructions which execute a method of determining membership of an element in a group, the method comprising: 
 receiving, from a software application, a request to determine if an element is a member of a group, the request being received by an evaluation engine having policy rules defining the group;    evaluating membership of the element in the group after the request is received by executing a script maintained separately from the software application and being available to an administrator for modification independently of the software application; and    sending a response to the software application, wherein the response is an indication of membership of the element in the group.    
   
   
       17 . The computer-readable medium of  claim 16 , further comprising the step of: 
 accessing a database external to the application to acquire additional information for evaluation of the request.    
   
   
       18 . The computer-readable medium of  claim 16 , wherein evaluating membership of the element in the group comprises evaluating a script having at least one IF/THEN statement.  
   
   
       19 . The computer-readable medium of  claim 16 , wherein the step of receiving, from a software application, a request to determine if an element is a member of a group comprises receiving the request by an evaluation engine via an application programming interface called by the application.  
   
   
       20 . The computer-readable medium of  claim 16 , wherein the step of sending a response to the application, wherein the response is an indication of membership of the element in the group comprises sending one of an access grant and an access denial concerning a user to an application that requested an access determination.